The Distinction Between Fraud and Unintentional Changes in Data Integrity

Fundamental Differences Between Fraud and Unintentional Changes

While both intentional fraud and unintentional changes threaten data integrity, their nature and the approaches to address them are fundamentally different. Fraud is primarily perpetrated by executives or managers, motivated by economic gain, regulatory evasion, or organizational pressure to meet targets. Such fraudulent activities include data deletion, selective reporting of results, backdating, and unauthorized modifications.

In contrast, unintentional changes occur due to misunderstanding of Standard Operating Procedures (SOPs), inadequate training, assumptions, or simple human error. Individuals making these changes believe they are acting correctly, but due to insufficient understanding of procedures or regulatory requirements, their modifications are ultimately incorrect. Examples include misunderstanding system usage, misconceptions about data recording timing, or improper understanding of change control processes.

However, from the perspectives of patient safety and product quality, both fraudulent alterations and unintentional changes carry equal gravity. Regulatory authorities (FDA, EMA, MHRA, PMDA, etc.) require compliance with the ALCOA+ principles of data integrity (Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available), regardless of the intent behind changes. Therefore, it is necessary to protect data from all inappropriate modifications and ensure authenticity, whether intentional or not.

Definition of Falsification and Its Regulatory Context

Understanding the precise definition of falsification is critically important in data integrity management. In general dictionary terms, it refers to “altering the original format or content either intentionally or through negligence,” and does not necessarily refer only to malicious acts.

From a regulatory perspective, falsification includes the following types of actions:

Intentional Falsification: Acts carried out with clear intent, such as data deletion, modification, concealment, or fabrication

Unintentional Falsification: Inappropriate changes due to human error, system misuse, or procedural misunderstanding

PIC/S Guideline PI 041-1 (2021 revision) and FDA’s Data Integrity Guidance (2018) require prevention of all changes that compromise data reliability, making it clear that appropriate management is necessary regardless of intent. Therefore, changes due to human error must also be considered a form of falsification, requiring appropriate preventive measures.

The Importance of Data Governance and Quality Culture

Ensuring data integrity requires both a robust data governance framework and the cultivation of a mature quality culture. This goes beyond mere blind compliance—the formal satisfaction of regulatory requirements—to refer to an organizational culture where all employees maintain ownership of quality and a consciousness of continuous improvement.

ICH Q10 (Pharmaceutical Quality System) defines both management leadership and active employee participation as the foundation of an effective quality system. Additionally, the WHO (World Health Organization) GMP guidance from 2023 emphasizes the importance of quality culture, requiring commitment to quality throughout the organization.

Key Elements of Quality Culture

Ensuring Psychological Safety: Creating an environment where errors and failures can be easily reported is the top priority. Rather than making employees who report errors subject to reprimand or punishment, it is necessary to cultivate a culture that values them as opportunities for early problem detection and improvement. This is based on the principle of “Just Culture,” which clearly distinguishes between deliberate violations and honest errors in response.

Practicing Systems Thinking: Rather than blaming individuals, it is important to identify and improve the root causes within systems, procedures, training, and equipment that led to errors. This approach aligns with Human Factors principles, viewing errors not as individual problems but as system design issues.

Effective Communication: It is important to build a culture where even small mistakes or potential problems can be easily reported and discussed through the activation of internal communication. Information sharing within the organization is promoted through regular quality meetings, cross-functional team activities, and open-door policies. By addressing problems before they escalate, serious quality issues and regulatory violations can be prevented.

Continuous Training and Capability Development: Regular and effective training on data integrity principles, accurate understanding of SOPs, and proper system usage is necessary. Rather than just classroom learning, incorporating practical exercises and case studies can deepen understanding.

Management Commitment and Role Modeling: It is essential for top management to clearly position quality as the highest priority and demonstrate this not just in words but through actions. Quality culture is embedded throughout the organization through clear quality and data integrity policies, allocation of sufficient resources, and prompt response to quality issues.

Practical Data Integrity Risk Management

The modern regulatory environment requires data integrity management through a risk-based approach. Based on the principles of ICH Q9 (Quality Risk Management), a systematic approach considering the following elements is recommended:

Data criticality assessment (identification of data within GxP scope), vulnerability identification (analysis of technical, procedural, and human factors), risk assessment and prioritization, implementation of appropriate controls (technical controls, procedural improvements, monitoring and review), and periodic effectiveness evaluation and continuous improvement.

Summary Table: Key Distinctions and Management Approaches

Aspect	Intentional Fraud	Unintentional Changes
Primary Actors	Management, executives, those under pressure	Any staff member with inadequate training
Motivation	Economic gain, regulatory evasion, meeting targets	Misunderstanding, lack of knowledge, human error
Examples	Data deletion, selective reporting, backdating	System misuse, timing errors, procedural mistakes
Detection Methods	Audit trails, whistleblower programs, management review	Quality control checks, regular training assessments, system validation
Prevention Strategy	Strong governance, segregation of duties, management oversight	Comprehensive training, clear SOPs, user-friendly systems
Response Approach	Investigation, disciplinary action, regulatory reporting	Root cause analysis, system improvement, additional training
Regulatory Impact	Equal severity in terms of patient safety and product quality

Conclusion

Ensuring data integrity is achieved through a comprehensive approach encompassing not only technical controls but also organizational culture, human factors, and governance structures. Understanding the difference between fraud and unintentional changes and implementing appropriate countermeasures for each—and above all, fostering a quality culture where all employees share responsibility for quality—is the key to sustainable data integrity management. To fulfill the pharmaceutical industry’s mission of protecting patient safety and product quality, it is imperative that the entire organization recognizes the importance of data integrity and commits to continuous improvement.